type — Windows File Read Reference
What is type?
type is a built-in Windows CMD command that reads and prints the contents of one or more text files to the terminal — the Windows equivalent of cat on Linux.
OSCP use: Quick way to read config files, credential stores, scripts, and sensitive files after gaining a foothold on a Windows target. No extra tools required.
Syntax
type [drive:][path]filename📌 1) All Flags & Behaviour
type is intentionally simple — it has no flags of its own. Behaviour is controlled by combining it with other CMD features:
| Usage | Description |
|---|---|
type file.txt | Print file contents to terminal |
type file.txt | more | Page through long output one screen at a time |
type file.txt | find "keyword" | Filter output for a specific string |
type file.txt | findstr /i "password" | Case-insensitive keyword search |
type file1.txt file2.txt | Print multiple files sequentially |
type file1.txt > output.txt | Redirect output to a new file (overwrite) |
type file1.txt >> output.txt | Append file to another file |
type file1.txt file2.txt > combined.txt | Concatenate files into one |
type nul > newfile.txt | Create an empty file |
type *.txt | Print all .txt files in the current directory |
📌 2) Common Examples
Read a file
type C:\Windows\System32\drivers\etc\hosts
type C:\Users\Administrator\Desktop\proof.txt
type C:\Temp\config.xmlRead with pager (long files)
type C:\Windows\win.ini | moreSearch inside a file
type C:\Temp\config.xml | findstr /i "password"
type C:\Temp\config.xml | findstr /i "user pass secret key"Read multiple files
type C:\Temp\file1.txt C:\Temp\file2.txtConcatenate files
type part1.txt part2.txt > combined.txtCreate an empty file
type nul > C:\Temp\placeholder.txt📌 3) Post-Exploitation — High-Value Files to Read
After gaining a foothold, use type to hunt for credentials and sensitive data:
Credential files
REM Unattend / Sysprep files (often contain plaintext passwords)
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\Unattended.xml
type C:\Windows\System32\Sysprep\sysprep.xml
type C:\Windows\System32\Sysprep\sysprep.inf
REM Web application configs
type C:\inetpub\wwwroot\web.config
type C:\xampp\htdocs\config.php
type C:\wamp\www\config.php
REM Database connection strings
type C:\inetpub\wwwroot\connectionstrings.configUser data & history
REM PowerShell history — **[[PowerShell History - PSReadLine]]**
(Get-PSReadlineOption).HistorySavePath
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
REM SSH known hosts / keys
type C:\Users\%USERNAME%\.ssh\known_hosts
type C:\Users\%USERNAME%\.ssh\id_rsaSystem files
REM Hosts file (network mappings)
type C:\Windows\System32\drivers\etc\hosts
REM Network config
type C:\Windows\System32\drivers\etc\networks
REM Boot config
type C:\boot.iniApplication config files
REM IIS config
type C:\Windows\System32\inetsrv\config\applicationHost.config
REM FileZilla (FTP server — stores credentials in plaintext)
type "C:\Program Files (x86)\FileZilla Server\FileZilla Server.xml"
type %APPDATA%\FileZilla\recentservers.xml
REM VNC password file
type "C:\Program Files\RealVNC\VNC Server\vncpasswd"
REM WinSCP saved sessions
REM (In registry: HKCU\Software\Martin Prikryl\WinSCP 2\Sessions)📌 4) Searching for Files to Read
Before using type, find the files:
REM Search for files named with "password"
dir /s /b *password* 2>nul
dir /s /b *pass* *cred* *config* *secret* 2>nul
REM Search for specific extensions
dir /s /b *.config *.xml *.ini *.txt 2>nul
REM PowerShell — search file contents for "password"
Select-String -Path C:\* -Pattern "password" -Recurse -ErrorAction SilentlyContinue
REM findstr across all files in a directory
findstr /s /i "password" C:\inetpub\wwwroot\*
findstr /s /i "password" C:\xampp\*📌 5) Linux Equivalent (cat)
| Windows CMD | Linux equivalent |
|---|---|
type file.txt | cat file.txt |
type file.txt | more | cat file.txt | less |
type file.txt | findstr "x" | cat file.txt | grep "x" |
type f1.txt f2.txt > out.txt | cat f1.txt f2.txt > out.txt |
type nul > file.txt | touch file.txt |
📌 Quick OSCP Cheat Sheet (Copy/Paste)
REM Proof files
type C:\Users\Administrator\Desktop\proof.txt
type C:\Users\%USERNAME%\Desktop\proof.txt
REM PowerShell history (credentials often here)
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
REM Unattend files (plaintext passwords)
type C:\Windows\Panther\Unattend.xml
type C:\Windows\System32\Sysprep\sysprep.xml
REM Web config (DB passwords)
type C:\inetpub\wwwroot\web.config
REM Hosts file
type C:\Windows\System32\drivers\etc\hosts
REM Search for password strings in a directory
findstr /s /i "password" C:\inetpub\*